Rules and risks

How the rules work

Several countries now protect consumers on instant payments, narrowly and with caps. None protects a large business, which relies on its bank contract, its own controls and insurance.

US. Reg E, the federal rule for consumers' electronic transfers, covers only consumer accounts and only unauthorized transfers, so even a consumer's scam payment falls outside it. Business instant payments fall under Article 4A, through the Fed's Regulation J for FedNow and RTP's own rules. The federal push for scam reimbursement went backwards: the CFPB dropped its suit against Zelle's operator and three large banks in March 2025, and a Senate bill to treat induced payments as unauthorized died with the last Congress. The fight moved to the states: on July 20, 2026 a New York judge let the attorney general's suit against Zelle's operator go ahead. Nacha's new ACH monitoring for payments sent under "false pretenses" doesn't change who bears the loss.

Open banking is in limbo. The CFPB's Section 1033 rule (October 2024) gave consumers a right to share their bank data and barred banks from charging for it. Banks sued the day it came out, the CFPB reopened fees and other questions in August 2025, a federal court in Kentucky blocked the rule on October 29, 2025, and the appeal waits while the CFPB rewrites it. Meanwhile US open banking runs on contracts between banks and aggregators.

UK. Since October 7, 2024, a bank whose customer (a consumer, micro-enterprise or small charity) is tricked into sending a Faster Payment or CHAPS payment must reimburse up to £85,000 within 5 business days, and the receiving bank repays half. To March 31, 2026, banks reimbursed £316 million, 88% of the money lost in the in-scope claims that were closed, at a cost of £44-56 million a year in extra controls. The regulator's evaluation found in-scope scam losses down about a fifth, while scams moved to international payments and crypto exchanges. The payments regulator is being folded into the FCA, and the Data (Use and Access) Act 2025 gives the government powers to put open banking under the FCA too.

EU. The Instant Payments Regulation made euro-area banks receive instant payments from January 9, 2025 and send them from October 9, 2025, at no more than the price of a standard transfer, with free Verification of Payee before the payer approves. A bank that skipped the check refunds a misdirected payment; one that warned the payer isn't liable if they went ahead. Businesses sending bulk files can opt out. Banks screen customers against sanctions lists daily instead of screening each payment, which wouldn't fit in 10 seconds. The Payment Services Regulation, agreed in November 2025, faces an indicative Parliament vote on December 14, 2026 and applies around 2028. It adds refunds when a fraudster poses as the victim's own bank, name checks on every credit transfer, liability for platforms that ignore reported scam content, and a dashboard to revoke data access.

Brazil, India and elsewhere. Brazil's central bank runs Pix and writes its rules, so it acts fast: MED 2.0 became mandatory on February 2, 2026, and after breaches at technology providers it capped payments by unlicensed institutions at R$15,000 in September 2025. India's central bank will compensate small digital-fraud losses from January 1, 2027, scams included: 85% of a loss of up to ₹50,000, capped at ₹25,000, once per person (reported). Australia's scams framework pulls in banks, telecoms and digital platforms, with most duties expected from 2027 (sources disagree on the dates), and Canada's Consumer-Driven Banking Act (March 26, 2026) ties payment initiation, targeted for mid-2027, to its new real-time rail.

What mistakes cost

Let's say a US manufacturer's AP clerk gets an email, apparently from a long-standing supplier, with new bank details, and pays a $250,000 invoice by RTP.

• Who bears it: the manufacturer. Its bank followed the agreed security procedure, so under Article 4A the payment is the manufacturer's, and the receiving bank could rely on the account number.
• What comes back: whatever the receiving bank agrees to return, if the money is still there. The FBI's Recovery Asset Team froze 58% of the amounts it tried to stop in 2025, in cases reported quickly.
• What's still owed: the real supplier's invoice, and who absorbs that becomes a negotiation.
• What prevention costs: a callback on changed bank details and a name check, mostly staff time.

In the UK the same email to a 50-person company is also the company's loss, since it's too big for the reimbursement rules; UK Finance counted £75.6 million in business scam losses in 2025.

The record so far: